HTTP-SVR-200-OK - GitLite

KO | EN

gitlite — search

#redis #postgresql #ai #nodejs #react-native #nextjs #svg #java #ruby #api

HTTP-SVR-200-OK

(★ 10)

Hand-rolled minimal HTTP/1.0 server written in x86_64 assembly, targeted towards Linux.

파일 탐색기

ZIP 다운로드

- - ci.yml
- STANDARDS.md
- .keep
- files.s
- helpers.s
- responses.s
- routing.s
- server.s
- session.s
- sha256.c
- users.s
- filedump.c
- saltdump.c
- smoke.sh
.gitignore
build.sh
CODE_OF_CONDUCT.md
CONTRIBUTING.md
LICENSE
mise.toml
README.md

# CDN으로 사용하기

jsDelivr

jsDelivr는 공개 GitHub 리포지토리를 별도 설정 없이 CDN으로 즉시 서빙합니다. 버전과 파일을 고르면 웹페이지에 바로 붙일 수 있는 링크와 예시 코드가 만들어집니다.

버전

파일

링크

예시

# 프로젝트 배지

CI 바로가기
GitHub last commit
GitHub repo size
Stars

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

A bare-metal x86-64 Linux HTTP/1.1 server written in assembly with a C SHA-256 helper (GNU assembler Intel syntax via GCC). Implements a single-threaded event loop with sequential accept/read/close via raw syscalls. Features: GET/POST routing, session-based authentication (SHA-256 salted password hashes, constant-time comparisons), authenticated `/files` directory listing with dynamic `Content-Length`, and 5-second receive timeout to bound slow-client stalls.

## Status

**Active** - core HTTP server + auth + file serving complete.

## Features

| Feature | Description |
|---------|-------------|
| Assembly core | GNU assembler Intel syntax, GCC-linked, no libc (`-nostdlib -ffreestanding`) |
| Raw syscalls only | `socket`, `bind`, `listen`, `accept`, `read`, `write`, `close`, `setsockopt`, `exit` |
| Single-threaded | One client at a time, sequential processing |
| HTTP/1.1 subset | GET, POST, headers, `Content-Length` (no chunked) |
| Routing | `/health`, `/register`, `/login`, `/logout`, `/files` (auth required) |
| Session auth | SHA-256 salted hashes via `getrandom(2)`, 96-byte slots |
| Timing-safe | Constant-time compare for passwords, usernames, tokens |
| Slow-client bound | `SO_RCVTIMEO` 5s |
| Auth `/files` | Dynamic `Content-Length` directory listing |

## Tech Stack

| Component | Details |
|-----------|---------|
| Language | x86-64 Assembly (GNU assembler via `.intel_syntax noprefix`) |
| Toolchain | GCC (assembler + linker) - `-nostdlib -no-pie -ffreestanding` |
| Syscalls | Linux x86-64 ABI: `socket(41)`, `bind(49)`, `listen(50)`, `accept(43)`, `read(0)`, `write(1)`, `close(3)`, `setsockopt(54)`, `exit(60)`, `getrandom(318)` |
| Crypto | SHA-256 in C (`sha256.c`) for password hashing |

## Architecture

### Module Map (`src/`)

| File | Responsibility |
|------|----------------|
| `server.s` | Main loop: socket → bind → listen → accept → setsockopt(RCVTIMEO) → read → parse → route → close → loop |
| `routing.s` | Method (GET/POST) + path dispatch → handlers |
| `responses.s` | HTTP response builders (200, 400, 401, 403, 404, 405, 500) |
| `helpers.s` | String utils, header parsing (`FIND_HDR_END`, `PARSE_CONTENT_LENGTH`) |
| `users.s` | User table (fixed 96-byte slots), registration, lookup |
| `session.s` | Session tokens (random), validation, invalidation |
| `files.s` | `/files` handler: `opendir`/`readdir` via syscalls, dynamic `Content-Length` |
| `sha256.c` | SHA-256 implementation (C, called from assembly) |

### Request Flow

1. **Accept** - `accept()` client FD, set `SO_RCVTIMEO=5s`
2. **Read** - `read()` up to 4096 bytes into `REQ_BUF`
3. **Parse Method** - Match `GET ` or `POST `, extract path pointer, set method ID
4. **Header Boundary** - `FIND_HDR_END` locates `\r\n\r\n`
5. **Content-Length** - `PARSE_CONTENT_LENGTH` extracts `Content-Length` (POST body validation)
6. **Route** - `ROUTE` dispatches to handler based on method + path
7. **Respond** - Handler builds response via `responses.s`, `write()` to client FD
8. **Close** - `close()` client FD, loop to `ACCEPT`

## Install / Build

### Prerequisites

| Requirement | Details |
|-------------|---------|
| GCC | For assembling/linking assembly + C |
| Linux | x86-64, raw syscalls |
| make | Optional (single script build) |

### Build

```bash
./build.sh http-server
# or manually:
gcc -nostdlib -no-pie -ffreestanding -fno-builtin -fno-stack-protector -o http-server src/*.s src/*.c
```

### Run

```bash
./http-server
# Listens on 0.0.0.0:8080
```

Place static files in `files_root/` for `/files` endpoint.

## Commands / Usage

The server has no CLI flags - it binds to port 8080 and runs forever:

```bash
./http-server &
curl http://localhost:8080/health
curl -X POST http://localhost:8080/register -d "username=alice&password=secret"
curl -X POST http://localhost:8080/login -d "username=alice&password=secret"
curl -H "Cookie: session=<token>" http://localhost:8080/files
```

### Endpoints

| Method | Path | Auth | Description |
|--------|------|------|-------------|
| GET | `/health` | No | Health response |
| POST | `/register` | No | Create account (username + password) |
| POST | `/login` | No | Start session, returns `Set-Cookie: session=...` |
| POST | `/logout` | Yes | Invalidate session |
| GET | `/files` | Yes | Directory listing of `files_root/` with `Content-Length` |

## Options / Configuration

Constants in assembly (modify `server.s`/`routing.s` and rebuild):

| Constant | Value | Description |
|----------|-------|-------------|
| Port | `8080` | `sin_port = 0x901f` in `server.s` |
| Backlog | `4096` | `listen()` backlog |
| Recv Timeout | `5s` | `SO_RCVTIMEO` tv_sec |
| Request Buffer | `4096` | `read()` max bytes |
| User Slot Size | `96B` | Fixed per-user record |

## Project Structure

```
HTTP-SVR-200-OK/
├── src/
│   ├── server.s          # Main loop, socket setup, accept/read/close
│   ├── routing.s         # Method + path dispatch
│   ├── responses.s       # HTTP response builders
│   ├── helpers.s         # Header parsing, string utils
│   ├── users.s           # User table, registration, lookup
│   ├── session.s         # Session tokens, validation
│   ├── files.s           # /files handler (auth + dir listing)
│   └── sha256.c          # SHA-256 (C, called from asm)
├── files_root/           # Static files served at /files (gitignored except .keep)
├── tests/
│   ├── filedump.c        # Debug: dump files_root contents
│   └── saltdump.c        # Debug: dump user table salts
├── build.sh              # One-line GCC build
├── server                # Built binary (gitignored)
├── .gitignore
└── README.md
```

## Testing

Install [mise](https://mise.jdx.dev/), then run:

```bash
mise trust
mise install
mise run check
```

The tasks use system GCC/Bash and pinned ShellCheck. `mise run build` builds
`server`; `mise run test` builds and runs HTTP/authentication smoke tests.
Tests require curl and a free port 8080, use temporary data, and stop their own
server afterward. After stopping a server, port 8080 may need about a minute
to clear before another run because the server does not enable address reuse.
CI runs the same tasks and uploads the tested binary and checksum.

## Notes / Gotchas

| Note | Details |
|------|---------|
| No libc | All syscalls inline, no `printf`, `malloc`, `pthread`, etc. |
| Single-threaded | One request at a time; slow clients blocked by `SO_RCVTIMEO` |
| Fixed user table | 96-byte slots, no dynamic allocation (no heap) |
| Session tokens | Random bytes via `getrandom(2)`, constant-time compare on validate |
| Password hashing | SHA-256(salt + password), salt from `getrandom(2)` |
| Port 8080 | Requires no root; change in `server.s` for port 80 |
| Linux-only | Syscall numbers and ABI are x86-64 Linux specific |

## License

MIT, see [LICENSE](LICENSE).

## Links

- **Repo:** https://github.com/rugbedbugg/HTTP-SVR-200-OK
- **Issues:** https://github.com/rugbedbugg/HTTP-SVR-200-OK/issues